TRM Labs links North Korean hackers to record $6.36B Binance theft

• TRM Labs

Blockchain intelligence firm TRM Labs has identified a North Korean state-sponsored hacking group as the likely perpetrator of the $6.36 billion cyberattack on cryptocurrency exchange Binance, the largest cryptocurrency theft ever recorded.

TRM Labs disclosed its findings in an investigative report published on its official website, TRMLabs.com, on October 29, 2026, titled North Korea Steals USD 6.36 Billion From Binance in the Largest Hack in History.  READ: Binance halts withdrawals amid suspected hack as $2.54B in crypto assets frozen 

The firm attributed the attack to TraderTraitor, a North Korean hacking unit previously linked to major cryptocurrency thefts, including the $1.5 billion Bybit hack in February 2025.

TRM Labs said its attribution was based on extensive blockchain transaction analysis and intelligence gathered outside blockchain networks.

The attackers reportedly transferred approximately $6.36 billion from Binance wallets across 10 blockchains, including Ethereum, Bitcoin, Tron, Solana and XRP Ledger. Most of the stolen assets were moved within approximately 20 minutes on October 29.

Investigators also discovered that preparations for the attack began at least 36 hours before the theft.

TRM Labs believes the attackers may have compromised Binance’s hot wallet signing infrastructure, allowing them to authorize transactions across different blockchain networks.

The firm said the attack demonstrated similarities with previous North Korean cryptocurrency operations, particularly the preparation of malicious transactions and the rapid movement of stolen funds.

TRM Labs reported that cryptocurrency companies and blockchain security organizations successfully froze approximately $2.7 billion worth of stolen assets. However, the attackers still controlled more than $2.4 billion in cryptocurrencies that could not be frozen by token issuers.

Binance confirmed the security incident and temporarily suspended withdrawals on several networks while investigating the breach. The exchange maintained that customer funds were safe.

The North Korean attribution remains TRM Labs’ intelligence assessment. No government had formally attributed the Binance attack as of the firm’s October 30 update.

TRM Labs said it continues to track the stolen cryptocurrency and share intelligence through its Beacon Network to help prevent the stolen assets from moving through cryptocurrency markets.